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(54) Monitoring computer network transactions 

(57) A network manager collects information and converts the information to reports that emphasize the 
network management and financial aspects of a computer network. The system provides a network 
monitor/data collection function 1, a network environment 4 to communicate among the activities, an end-user 
interface system 1 1 to support network information services; and a resource center 2 which is a repository of 
network data collected, information processing, and network coordination and monitor data collection - 
personality. The network transaction data is collected by network monitors 1 and is transmitted in a processed 
form to the central resource center 2, which performs a series of data f^artipulation fuhctiphs and stores in a 
database the information necessary to produce both standard and user defined reports. - 
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ENTERPRISE NETWORK MANAGEMENT METHOD AND APPARATUS 



Field of the Invention 

The present invention relates generally to a network monitoring facility. In 
particular, the present invention relates to a system for summarizing network usage to 
give general business decision support; The system of the present invention provides 
reports of network transactional information from financial and operational viewpoints. 
Background of the Invention 

the growth of the networking solution to enterprise-wide computer applications 
has spawned a number of user problems. Many of these problems are based on the 
operational aspect of the computer hardware and software. The p occur 
have resulted a number of systems to monitor the network facilities to allow an efficient 
fault tracking capability. These monitoring systems generally encompass hardware and j 
software that are located at the different client locations and that collect and report on 
the network operation; the method of user, inteitace and the scope; of this supports 
varies by system but the general purpose is cor^istently theAqujc^xletectipn of network [ 
faults or problems and the efficient resolution of these faults or problems or a graphical 

"i 

representation of the network topology. This class of product is designed for use by the ■ 

system administration professional having numerous years of network expertise. : 

i 

For example, U.S. Patent Number 5,315,580 to Phaal for a "Network Monitoring 

! 
i 

Device and System" discloses a system composed of hardware and software for 
monitoring and sampling network packets and for delivering this information to a central 

i 

! 

1 ; 



1 measurement station. U.S. Patent Number 5,31 7,564 to Nugent for a "Merging 

2 Network for Collection of Data from Multi-Computers" discloses a system of hardware 

3 and software for measuring parameters of operation and transmitting them as packets 

4 to a collector node for processing. U.S. Patent Number 5,295,244 to Dev. et al. for a 

5 "Network Management System Using Interconnected Hierarchies to Represent 

6 Different Network Dimensions in Multiple Display Views" discloses a network manager 

7 which represents the interactions of network entities to a user. It provides a way for the 

8 user to access information about the status of the network. U.S. Patents Numbers 

9 5,226*120 to Brown, et al. , 5,101,402 toChiu, et al. , 5,067,107 to Wade , and 

1 0 4,81 7,080 to Soha all disclose similar combinations of hardware and software for 

11 monitoring the network data by examining packets arid presenting a summary of the 

12 traffic to support the network administrator 

13 Early computer networks were simple mainframes communicating to remote job 

1 4 entry (RJE) stations having functions limited to the processing of transactions in 

15 support of enterprise applications. These computer networks have evolved into 

16 massive complex topologies. The operation of these networks support all phases and 

1 7 operations of the business enterprise. This support includes the former transaction 

1 8 processing applications as well as all phases of the management hierarchy. There are 

19 very few business activities that are not supported by these complex computer systems. 

20 An implication of this growth in size, complexity, and functionality is that almost all costs 

21 of the various business activities are related to the efficient and cost-effective operation 

22 of the computer network. The evolution of the purpose and sophistication of the 
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monitor programs has not met this increased level of operational need. 

The evolution of computer application has followed a steady path from the old 
transaction type of processing (payroll, billing, etc.) to almost all levels of the business 
t hierarchy. Many products exist that support the executive in analyzing the information 
, gathered from business applications in order to make well informed specific operational 
y ma nagement decisions. The user interfaces of these products have also been 
enhanced to allow executives the ability to view this information and even to create new 
ad-hoc views to support their particular business activities. These products allow the 
summarizing of transactional data and the creating of simple but effective 
representations that will allow the decision maker to make an informed decision as well 
m as tocrea^epreseritations^ to 
,f^^ e ^ions. This use of the jo^ 

up to the minute operational views has not yet been translated into network monitoring 
activities. 

The ^nitoring programs that are available can be compared to the 

earty programs that allowed some creation of transactional si^mary information from 
the early computer applications. The present day monitors require a computer 
professional to understand the implications of the network transactions and the results 
are given purely in terms of finding and the detecting any faults and operational 
difficulties of the network. Other products only focus on giving a graphical 
representation of the network. There is a strong and present need to upgrade the level 
of these programs to facilitate the same sort of decision support mechanisms that are 



1 available to the business management executives. 

2 The monitor programs currently available allow the user to pick a transaction - 

3 type and to pull network statistics from simple databases that keep a record of all 

4 packets (lowest level of network transaction). These statistics can be formed into 

5 reports that are understood by an experienced network professional in order to 

6 facilitate the detection of the location and type of network fault conditions. Other types 

7 of systems could be used to collect and present, in a meaningful and useful way, the 

8 kind of information required by business management executives. 

9 For example, there has long been a heed to be able to control the network 

10 operation from an executive management perspective. The information that is being 

11 gathered could be combined with business iriformattbn relating to costs of operation. 

12 The user interface should bci able to be us6d by a no^ and the 

1 3 information that is presented would pertain to the business objectives and control of the 

14 computer network as a critical business function. The ability to create timely ad-hoc 

15 reports of the information cross referenced by location, time of day, and type of 

16 equipment and/or other factors of interest to the user would play an important role in 

1 7 helping management determine the most efficient usage of the most costly network 

1 8 components. These reports should also identify what usage requirements are needed 

19 in each location including the elusive random burst usage information. A system is 

20 necessary to make this evolutionary leap to control these increasingly complex network 

21 topologies with a simple easy to understand implementation and user interface in order 

22 to provide meaningful information and useful network activity measurement capabilities. 
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Summary of the Invention 

It is therefore an object of the present invention to provide a computer hardware 
and software system to facilitate the user's financial and organizational control of the 
network topology. 

It is an additional objective of the present invention to provide an overview of the 
entire network with a minimum of delay. (Nominally less than 10 minutes delay for a 
view of the user's entire network.) 

It is a further objective of the present invention to provide data pertaining to 
network cost factors, for example, network mairtfenance p hardware 
mean-time to failure and mean-time to repair, 
f It is also an objed^ 

operations in differ dierrt/server, or by usir defined transaction * 

activity and/or essentially any factor that can be user defined. 

It is a further objective of the present invention to provide dedicated virtual 
network equipment and network facility reports; * 

" It is an additional dbje<^ indention to prowde users ability to 

easily update network information such as client/server additions and deletions before 
the effective date of the change. 

It is another objective of the present invention to provide information on the 
condition of the network, LAN, or client/server availability. 

It is also an objective of the present invention to provide information on network 
operations and statistics on network activity, site location, equipment type, and 



1 communication link type. 

2 It is yet a further objective of the present invention to provide a comparison of 

3 vendor performance such as the impact of time of day, holidays, major disasters, etc., 

4 on vendor performance. 

5 These and other objects and advantages of the present invention will be 

6 apparent to those of ordinary skill in the art upon inspection of the detailed description, 

7 drawings, and appended claims. 

8 The system of the present invention is a means for supporting a network 

9 manager by collecting data pertaining to the financial and operational characteristics of 

10 networks. The network manager collects information and converts the information to 

11 reports that emphasize the network management and /financial aspects of a computer 

12 network. These reports may be selected, designed and/or formatted by the network 

13 executive in a manner that best meets the manager's unique needs. 

1 4 The present invention accomplishes this function through the use of four distinct 

15 activities performed by the system. These activities provide a network monitor/data 

16 collection function, a proprietary network environment to communicate among these 

17 activities, an end-user interface system to support network information services, and a 

18 resource center activity is a repository of network data collected, information 

19 processing, and network coordination and monitor data collection personality. 

20 The network transaction data is collected from each configured LAN by the 

21 attached network monitors. This data is transmitted in a processed form to a central 

22 resource center. The central resource center performs a series of data manipulation 
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1 - 'neons and stores in a database the informal necessa* to pWe ^ ^ 
and user-defined reports. The end-user is a (l0 wed to direct* input data that gives 
vendor specific information, and aiso to input a description of toe netwo* t^ 
software, and interfaces. The end^ser can aiso define sut^vities Wrt ua, ne^s, 
to MM. me Tacking of information in reiation to a specific business unit The end- 
user may specify a number of conditions (alarms) ma, will produce specific 
manademen, attention if met These indude crftica, and sensfcVe situations as weH as 

8 specific location outages. 

9 Brief De Sft rip tion of tfia nr a ^^ r 
FIG. 1 

11 ^Detailed Desmbtfon nf tho p~ e ^. fni . rntfnr 

12 -"Definitions ' •' 
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Network Management Resource Services or "NMSR") is a product family that 
allowsente^ 

costfperformance of a business activity. 

A Transaction is one or more functions, which, when executed. accomplish a 
specific enterprise purpose (business or network). 

NMRS Data is data generated from the NMRS Monitor for database use. 
NMRS Monitor is the source of NMRS data. This is normally a device that is 

20 connected to each LAN in a network. 

21 User Console is an input/output device that permits the user to communicate 
with the NMRS User Service Management Resource Desk. 
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1 NMRS User Resource Qesk is an interface that responds to a user request and 

2 accepts user-provided instructions and data from the user console. 

3 Sub-Activity (Business) is a network activity that is an integral subset of a 

4 Business Activity. For example, inventory "look up" might be a sub-activity of a Sales 

5 Activity. 

6 Disclosure 

7 The present invention, known as Network Management Resource Services 

8 (NMRS). is able to collect and monitor network traffic information and altow high level 

9 financial and operational management information. This information is used to support 

10 strategic network management decisions in such areas as asset management and 

11 control, vendor harc^are repair/maintenance cost c»m and other user 

12 configurable reporting areas. The differerrt system functions are^ m 

13 enterprisewide collection of network data and to transform this data into information 

14 that is available to a management professional. 

15 The user (typically a network executive or staff) can retrieve figures on the 

16 MTBF for vendor specific, site specific usage rate, activity type. etc. The system focus 

17 is on the reporting of network performance and availability, and on numerous cost 

18 factors as opposed to fault diagnosis. Referring to FIG. 1. the NMRS system is 

19 described. The NMRS system includes four major functional modules. These are the 

20 NMRS Resource Center 2. the User Resource Management Center 11. the NMRS 

21 Network Facility 4. and the NMRS Monitor 1. 

22 The NMRS Resource Center 2 serves as a database depository to support user 

8 



1 network data collection and user report generation. This service is supported by and is 
Physically located on a supper's premises. The system * supported by the use of a 
database manager, the NMRS Network Facility 4, computer system hardware base, 

4 NMRS application programs, and the transmitted data summaries collected by the 

5 NMRS Monitor 1. 
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The User Resource Management Center 11 has a functional capability s^ 
that of the NMRS Resource Center 2. ll^1*pKy^l^"«ih,^ 
premises whereas the NMRS Resource Center 2 is Ideated on the suppliers premises. 
The system is set up and supported by components similar to those of the NMRS 
Resource Center 2. One exception is that the data collection function is only performed 
11 by the NMRS Resource Center 2. An NMRS 0s*C6rmmMa*e6 to this system 
in^rder to provide the uierwitK an application^ information: 
This information is downloaded from the NMRS Resource Center 2 via the NMRS 

14 Network Facility 4. 

15 The NMRS Network Facility 4 transports date collected from the user network by 
the NMRS Monitor 1 to the NMRS Resource CehSr VWs lata ca>i be summarized by 
the NMRS Monitor 1 to limit the amount of data that is sent The NMRS Network Facility 
4 is also used to transport the data required to provide NMRS services to its users. 

The NMRS Monitor 1 is connected to each LAN in the user's network. The 
NMRS Monitor 1 collects data for each user-defined transaction. The summarized 
results are passed to the NMRS Resource Center 2 via the provided NMRS Network 
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1 Facility 4. 

2 The NMRS Resource Center 2 defines the logical user network by the use of 

3 three directories. These directories support the storage and retrieval of user 

4 information to identify the hardware, links, and customer-specific information that 

5 details the type of transactions to be managed as well as data on vendors and 

6 business activities. These directories are called the Equipment Directory 6, the 

7 Communications Directory 7, and the Transaction (subractivity) Directory 8. 

3 The Equipment Directory 6 is a group of tables that define the network and 

9 record data for use in customer reports. The following is an outline of some key items 

1 0 that are included in the equipment directory: 

11 - LAN table - a record for each user LAN; 

12 - LAN tvoe table - a record for each type of user LAN;. 

! 3 . Site table - a record for each user site where one or more LAN's are located;. 

14 . status table - a record for each customer-assigned state condition;. 

15 - Device table - a record for each device (or node) on any LAN; 

16 - Kind table - a record for each kindle server, eto.) of ' device on any LAN; , 
•) 7 . Device tvoe table - a record for each type of device (or node) on any LAN 

18 (example: Compaq 486-1 6, 16M, 500MB); 

1 9 - os table - a record for each type of operating system used in a device on any 

20 LAN (example: DOS 6.2). 

21 The Communication Directory 7 defines which interconnect network LANs. Th< 

22 may be as few as one communications link in this directory. 

10 



1 - Vendor table - a record for each vendor(or supplier) of communications channels 

2 connected to devices on any LAN. Typically the communication channel is connect to 

3 a LAN by a router device. 

4 , The Transaction Directory 8 contains a group of tables that define the virtual 

5 : networks constituting the total enterprise network. This organization will always contain 

6 at least the following two tables: 

7 - Sub-gctivitv table - a record for each customer-defined sub-activity defined for 

8 any business activity; and 

9 ' Business activity table - a record for each customer-defined business activity. 

10 The NMRS Resource Center 2 supports two other basic functions. These are a 

11 Performance Database 10 and an Alarm Director^ 1p 

12 ; cwiteins^ 

13 business activity which provides the number of frames and average sizes of frames for 

14 each period of time (nominally six minutes). The^arm pirectory 12 is a group of tables 

15 that specify customer-assigned names for alarm conditions, customer selections for 

16 conditions to be alarmed and customer selection of alarm display and alerting 

17 treatment 

18 The User Resource Management Center 11 contains a similar technical 

19 organization. The information is received from the NMRS Resource Center 2 based on 

20 a user request that is entered via the User Console 3 and downloaded by the NMRS 

21 Network Facility 4. There is no network monitor data collection function within this 

22 system. This keeps the process of collecting and packaging of network transactions 

11 



1 from affecting other non-NMRS applications. 

2 The NMRS Network Facility 4 provides the coordination between the various 

3 NMRS activities. This mechanism will provide the means by which the collected data 

4 from the NMRS Monitor 1 is transported to the NMRS Resource Center 2. The NMRS 

5 Network Facility 4 also delivers the information to the User Resource Management 

6 Center 1 1 that is necessary to support the various end-user information analysis and 

7 maintenance applications. 

8 The NMRS Monitor 1 is connected to each LAN in the user's network. The 

9 NMRS Monitor application collects data for each user transaction. Each data record 

10 has at least five pieces of information. These are the origination unit, the destination 

11 unit, the transaction type, the frame count, arid the frame size. At a programmable 

12 interval, the user activity records are bundled by the monitor together with a header 

1 3 including the monitor number, the time interval, and the record count The processed 

14 activity records with a header record are transmitted to the NMRS Resource Center 2 

15 via the NMRS Network Facility 4. 

16 Once the NMRS is installed, the user-specific data about the configuration of the 

1 7 network is entered. This will include all of the information used to support the end-user 

1 8 applications as well as customer selected information to support specific personalized 

1 9 application interfaces. This information includes data about the type of hardware, the 

20 location of hardware, LANs, virtual (logical) networks, operating systems, vendors, and 

21 definitions for business activities and sub-activities. Also, the user describes the names 

22 and conditions and user-interface options of the alarms (management alert) database. 

12 



Once the NMRS is operational theNMRS Monitor 1 win b^gin to transmit 
transaction data to the NMRS Resource Center 2. First, the information is grouped and 
packaged with information identifying the particular monitor. The information is sent to 
the NMRS Resource Center 2 via me NMRS Network Facility 4. The information is then 
anaryzed and records are created that store transaction averages by activity and sub- 
activity. \w/ : . .. 

The User Resource Managements 
information to the end-user via the NMRS User Console 3 The user will select to 
begin: The NMRS fteso^ 

Faciftty 4. The NMRS application ^ 

support ^ _ a 

period of iess lha^ 

The end-user can select from a wide variety of reports that use the existing 
database. A partial list includes : 

- hardware repair /maintenance by vendor report; 

- MTBF rates by vendor; 
MTBF rates by site location; 
MTBF by usage rate; 

MTBF by activity or sub-activity type; 
vendor response time by location; 
vendor response time by time of day; 
vendor mean time to repair; 
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1 - asset control and location reports; 

2 - comparisons for the same operational hour by hardware type; 

3 - comparisons for the same operational hour by transaction type; 

4 - equipment reports. • 

5 These reports show the orientation of the information with respect to network 

6 availability, relative cost factors, and network performance versus fault diagnosis. Many 

7 other types of reporting can be selected by using the data that has been collected in 

8 creative user selectable ways, 

9 Preferred and alternate embodiments of the present invention have now been 

10 described in detail. It is to be noted, however, that this description of these specific 

1 1 embodiments is merely illustrative of the principles underlying the inyen^e concept It 

12 is therefore contemplated that various modifjcatfons of the disclosed embodiments will, 

1 3 without departing from the spirit and scope of the invention, be apparent to persons of 

14 ordinary skill in the art 
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CLAIMS : 

1 . A method for providing reports on characteristics of a computer network, 
comprising: 

a) monitoring ail network transactions; 

b) collecting data for the network transactions; 

c) providing the data to a centralized database; 

d) manipulating the data to produce a standard report describing management 
and financial characteristics of the network; 

e) receiving a user request for a standard report; 

f) transmitting the standard report to an end-user location; and 

g) presenting the standard report to the user. 
2 - The method of daim 1, further comprising: 

a) receiving user inputs defining particular network transaction data of interest; 

b) receiving user data defining particular report format parameters; 

c) receiving user data defining a network topology of interest; 

d) manipulating the data defining particular report .format data, the data 
defining particular report format parameters, and the data defining a network 
topology of interest to produce a custom report describing the network 
management and financial characteristics of the network of interest to the 
user; 

e) receiving a user request for a custom report; 

f) transmitting the custom report to an end-user location; and 
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1 g) presenting the custom report to the user. 

2 3. The method of claim 2, further comprising: 

3 a) storing the user inputs defining particular network transaction data of 

4 interest of a first user, the user data defining particular report format 

5 parameters of the first user, and the user data defining a network topology of 

6 interest of the first user and 

7 b) automatically applying the user inputs defining particular network 

8 transaction data of interest of the first user, the user data defining particular 
g report format parameters of the first user, and the user data defining a 

I o network topology of interest of the first user to the network data in response 

II to a request for a network report by the first user. 

12 4. The method of claim 1, further comprising summarizing the data for the 

1 3 network transactions prior to transmitting the data to the centralized database. 

14 5. The method of claim 1. wherein the standard report further describes 

15 operational characteristics of the network. 

1 6 6. The method of claim 1 ; wherein providing the data to a centralized database 

1 7 includes sending the data via a dedicated communications facility to the centralized 

18 database. 

19 7. The method of claim 6, wherein the dedicated communications facility is a 

20 virtual network. 

21 a The method of claim 6, wherein the dedicated communications facility is a 

22 physical communications network. 

16 
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1 9. The method of claim 1, wherein the monitoring of network transactions and 

2 ihe collection of data takes place continuously. 

10. The method of claim 1, wherein monitoring all network transactions 
comprises capturing and measuring user local area network activity, and wherein 
collecting data for the network transactions comprises classifying the local area 
network activity according to defined categories. 

11. Themethod of claim 6, wherein monitoring al( network transactions 
comprises capturing and measuring user local area network activity, and wherein 
collecting data for the network transactions comprises classifying the local area 
network activity according to defined catgories. 

,12. The method of claim 10, wherein the defined catgories are user-defined.- 

^13 ^ 

least one directory, said at least one directory being selected from the group of 
directories consisting of equipment directories, transaction directories, and 
communications directories, 

14. The method of claim 1, further comprising manipulating the data to produce 
a custom report describing management and financial characteristics of the network 
according to any format defined by a user. 

15. The method of claim 1, further comprising storing the report for future 
presentation to a user. 

16. The method of claim 15, further comprising presenting a plurality of stored 
reports to the user in a comparison format. 
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17. A system for providing reports on the characteristics of a computer network, 
comprising: 

a) a monitor disposed to monitor ail network transactions; 

b) a network manager disposed to collect data for the network transactions; 

c) a central resource center; 

d) a network facility disposed to provide the data to a centralized database and 
to provide a standard report to an end-user location, the standard report 
describing the network management and financial characteristics of the 

' network; 

e) a processor disposed to manipulate the data to produce the standard report 
and to receive a user request for a standard report; and 

f) a presentation device disposed to present the standard report to the user. 

18. The system of claim 17, wherein: 

a) the processor is further disposed to receive user inputs defining particular 
network transaction data of interest; 

b) the processor is further disposed to receive user data defining particular 
report format parameters; 

c) the processor is further disposed to receive user data defining a network 
topology of interest; 

d) the processor is further disposed to manipulate the data defining particular 
report format data, the data defining particular report format parameters, and 
the data defining a network topology of interest to produce a custom report 

18 



describing the network management and financial characteristics of the 
network of interest to the user 

e) the processor is further disposed to receive a user request for a custom 
report; 

0 the network is further disposed to transmit the custom report to an end-user 
location; and 

g) the presentation device is further disposed to present the custom report to 
the user. 

19. The system of claim 18, further comprising: 

a) memory in the centralized databas^adapted to store the user inputs 
defining particular ne^^ me 
usw d^ defining the first user, and 
the user data defining a network topology of interest of the first user and 

b) wherein the processor is adapted to automatically apply the user inputs 
defining particular ne^ of interest erf the fjrstuser, the 
^^^^ P^P^X9^ ^^ f^vB^^f the? first user, and 
the user data defining a network topology of interest of the first user to the 
network data in response to a request for a network report by the first user. 

20. The system of claim 17, wherein the central resource center is further 
adapted to summarize the data for the network transactions prior to transmitting the 
data to the centralized database. 

21 . The system of claim 1 7, wherein the standard report further describes 

19 



1 operational characteristics of the network. 

2 22. The system of claim 1 7, wherein the network facility comprises a dedicated 

3 communications facility. 

4 23. The system of claim 22, wherein the dedicated communications facility is 

5 further connected to the processor. 

6 24. The system of claim 17, wherein the dedicated communications facility 

7 comprises a virtual network. 

3 25. The system of claim 17, wherein the dedicated communications facility 

9 comprises a physical communications network. 

10 26. the system of claim 17, wherein the monitors are further disposed to 

11 continuously monitor all network transactions and the network manager is further 

12 disposed to continuously collect data for the network transactions. 

1 3 27. The system of claim 1 7, wherein all network transactions comprise user 

14 local area network activity and wherein the network manager is further disposed to 

15 classify the local area network activity according to defined categories. 

16 28. The system of claim 22, wherein ail network transactions comprise user 

1 7 local area network activity and wherein the network manager is further disposed to 

1 8 classify the local area network activity according to defined categories. 

19 29. The system of claim 27, further comprising a directory input device disposed 

20 to accept an equipment directory, a communication directory, and a transaction 

21 directory and further to define the network in terms of the equipment directory, the 

22 communication directory, and the transaction directory. 

20 



1 30. The system of claim 17, wherein the processor is further disposed tq 

2 manipulate the data to produce a custom report according to any format defined by a 

3 user and to receive a user request for the standard report. 

4 31 . The system of claim 1 9, wherein the memory is further adapted to store the 

5 standard report. 

6 32. The system of claim 30, wherein the memory is further adapted to store the 

7 custom report 

8 33. The system of claim 31, wherein the r processor is further disposed to 

9 manipulate a plurality of stored reports to produce a comparison report in a format 

10 comparing data presented in the plurality of stored reports and to receive a user 

11 request for a comparison report 

12 I 4 - The system of claim 32, wherein the processor is further disposed to 

13 manipulate a plurality of stored reports to produce a comparison report in a format 

14 comparing data prsented in the plurality of stord reports and to receive a user request 

15 for a comparison report 

35. A method for providing reports on characteristics of 
a computer network, the method being substantially as herein- 
before described with reference to the accompanying drawing. 

36. A system for providing reports on characteristics of 
a computer network, the system being substantially as herein- 
before described with reference to the accompanying drawing. 
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